How to properly address DDOS concerns with crossbar.io?

[tortoisedoc]

Suppose a malicious actor reverse-engineers my cool website.
Suppose now that this actor implements a rouge client, that connects with a valid account over crossbar
to our backend services.
When this rouge actor now triggers a DDOS via websocket;

• how can I recognize this?
• what is the best way to block it?

I know there is the "stats" api calls; but it appears to me to be quite computationally intensive,
if for each user I need to keep a bucket with individual information.
Apache / HAProxy only manage things at HTTP level / session setup.

Is there other means?

[oberstet]

what is the best way to block it?

what's the peak bandwidth you need to defend against?

[tortoisedoc]

hm good question, id assume a few hundred kb / client/ second would suffice

[oberstet]

let's assume 200kbps and 1m devices in a bot net, that means: 200gbps aggregate DDoS attack bandwidth. you will unlikely be able to defend once that traffic hits your infrastructure, hence you need to mitigate at the source around the globe. IOW: use Cloudflare or similar ..